Synology Mail Server Authorization Vulnerability Allowing Unrestricted Access to Non-Sensitive Settings

A vulnerability exists in Synology Mail Server that enables remote authenticated attackers to read and modify non-sensitive settings, as well as disable certain non-critical functions. This issue arises from missing authorization checks, allowing for unauthorized changes by authenticated users.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of settings and disruption of non-critical functions within the Mail Server application.

Remediation

Users are advised to upgrade to Synology Mail Server version 1.7.6-20676 or above for DSM 7.2, or version 1.7.6-10676 or above for DSM 7.1.